The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bash script using a path constructed from user-provided input, which could lead to command injection if the input contains shell metacharacters. The agent is instructed to run bash <skill-directory>/scripts/onboarding.sh <vault-path> where <vault-path> is the location provided by the user in Step 2. Without sanitization, a malicious user could provide a path containing characters like ; or $() to execute arbitrary code.
[EXTERNAL_DOWNLOADS]: The skill automates the global installation of third-party CLI tools from the NPM registry. It performs npm i -g @steipete/summarize, npm i -g @tobilu/qmd, and npm i -g agent-browser based on user selection in Step 5. These packages are maintained by individual users and installed globally, which typically requires elevated privileges.
[PROMPT_INJECTION]: The skill ingests untrusted user input and incorporates it into agent configuration files that govern the behavior of other AI agents.
Ingestion points: Steps 1, 2, and 3 in SKILL.md collect user-provided vault name, location, and domain description.
Boundary markers: Absent. User input is interpolated directly into templates like claude-code.md and cursor.md without delimiters.
Capability inventory: The skill uses Bash, Read, and Write tools to create directories and write configuration files.
Sanitization: No sanitization or validation is performed on the user-provided strings before they are used in file paths or written to configuration files.

second-brain